The policy should state how and when the vendor publishes advisories and whether the reporter's own publication is expected to wait for the coordinated date, linking the policy to clause 7 and the embargo of 5.6.8.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.